healer | 1268bf4ecb4df18a18e265cf7498ec0c0e3f30c580abed8d233e30ab0eb59a12 | Triage

Submit
Reports

Overview

overview

Static

static

3

2b43e25a7d...KI.exe

windows7-x64

2b43e25a7d...KI.exe

windows10-2004-x64

Sharing

General

Target

2b43e25a7dccb9cc67de6756e29b86b0_NEIKI
Size

257KB
Sample

240507-zhay8aeg81
MD5

2b43e25a7dccb9cc67de6756e29b86b0
SHA1

66b3a1f81e2affd7fed7b686739c34a095d48ec7
SHA256

1268bf4ecb4df18a18e265cf7498ec0c0e3f30c580abed8d233e30ab0eb59a12
SHA512

781562d9bfdfc8cf956ac26ce18c74e7803f7d2fdbbd856711a8d1291ef54dc039ddd1004aa907742d0a2c263b47c24b3ad754e97b770d2b21e18caf01001c16
SSDEEP

3072:PGo0bYZpn0YkotIzlKSZ37RpMmVN0T1RhIVh3ztvHFzpfO6GUix5iwJ:abYZpxORKArRW8ofhs1BF891Ww

Score

10^/10

healer dropper evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2b43e25a7dccb9cc67de6756e29b86b0_NEIKI.exe

Resource

win7-20231129-en

healer dropper evasion trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

2b43e25a7dccb9cc67de6756e29b86b0_NEIKI.exe

Resource

win10v2004-20240426-en

healer dropper evasion trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  2b43e25a7dccb9cc67de6756e29b86b0_NEIKI
- Size
  
  257KB
- MD5
  
  2b43e25a7dccb9cc67de6756e29b86b0
- SHA1
  
  66b3a1f81e2affd7fed7b686739c34a095d48ec7
- SHA256
  
  1268bf4ecb4df18a18e265cf7498ec0c0e3f30c580abed8d233e30ab0eb59a12
- SHA512
  
  781562d9bfdfc8cf956ac26ce18c74e7803f7d2fdbbd856711a8d1291ef54dc039ddd1004aa907742d0a2c263b47c24b3ad754e97b770d2b21e18caf01001c16
- SSDEEP
  
  3072:PGo0bYZpn0YkotIzlKSZ37RpMmVN0T1RhIVh3ztvHFzpfO6GUix5iwJ:abYZpxORKArRW8ofhs1BF891Ww
Score

10^/10

healer dropper evasion trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasiontrojan

behavioral2

healerdropperevasiontrojan

© 2018-2024

Terms | Privacy